APT Emulation and Detection in ICS/OT

Grade: A3

Read the full MSci dissertation

Industrial control systems sit behind services such as electricity generation, water treatment and manufacturing. As IT and operational technology become more connected, attackers can move from an ordinary enterprise workstation towards engineering systems and the programmable logic controllers (PLCs) that control physical processes.

My MSci project investigated how to capture that complete journey. The aim was to create a realistic, provenance-capable dataset that could support the reconstruction and detection of multi-stage attacks spanning IT, OT and PLC environments.

From real attacks to an emulated campaign

I analysed nine significant ICS malware families and campaigns from 2010 to 2024, including Stuxnet, Industroyer, TRITON and PIPEDREAM. Mapping their behaviour to MITRE ATT&CK for ICS identified 69 unique techniques across the attack lifecycle.

Rather than copying one campaign, I used those findings to design a representative two-day attack scenario. It began with an enterprise-side compromise, moved laterally through the operational network and ended with manipulation of physical controllers. The scenario exercised 53 of the techniques identified in the earlier analysis.

Building the testbed

The testbed followed the Purdue Model from Level 4 down to Level 0. Its enterprise and engineering zones ran as virtual machines on separate hypervisors, connected through a jumpbox acting as the industrial DMZ. OPNsense routers enforced the boundary between the zones.

At the process level, physical Siemens S7 PLCs controlled a scaled hydroelectric plant. This mattered because it produced real S7Comm traffic and genuine controller state changes that a software-only simulation would not fully reproduce.

The environment included:

• Separate enterprise, DMZ and engineering zones
• Windows user, engineering, historian and SCADA systems
• Two OPNsense routers enforcing segmentation
• Physical Siemens PLCs and HMIs
• A scaled hydroelectric process
• Raspberry Pi-based attacker and command-and-control infrastructure

Automating the attack with MITRE Caldera

I used MITRE Caldera 5.3.0 to automate the campaign and record each executed stage. Caldera's operation reports provided ground truth linking captured events back to specific attack steps.

The campaign covered phishing and initial access, command and control, discovery, credential access, lateral movement, data collection and PLC-focused impact. Combining realistic attack progression with repeatable automation made the resulting data more useful for later analysis.

Collecting data across every layer

Telemetry was collected simultaneously throughout the testbed:

• Sysmon events from every Windows virtual machine
• Packet captures from both hypervisors and the mirrored PLC network
• Process data from the historian's InfluxDB instance
• Diagnostic logs from the physical PLCs
• Caldera operation reports used as attack labels

These sources were brought together using the PROV-DM provenance model. Instead of treating each alert as an isolated event, provenance records causal relationships between processes, files, connections and devices. That makes it possible to trace how an initial compromise developed into an action affecting the physical process.

Validating the dataset

I validated the work in two ways. First, I manually reconstructed representative attack paths across the provenance graph, including a complete cross-layer chain on the first attack day and the PLC destruction sub-chain on the second.

Second, I trained a baseline GraphSAGE model using labels derived from the Caldera reports. The model outperformed constant-prediction baselines on both attack days, showing that the graph contained learnable signals and could support provenance-based machine-learning research.

What I learned

This project brought together network architecture, adversary emulation, Windows telemetry, packet capture, PLC communication, data engineering and graph-based detection. It also demonstrated why OT security cannot be treated as ordinary enterprise security: availability and safety are central, legacy equipment is common, and the most useful evidence may be spread across several technical layers.

The strongest part of the resulting dataset is that combination. It connects host and network activity to real controller-side effects, while Caldera provides structured ground truth for the attack steps.

---

This work was completed at the University of Glasgow Cyber Defence Lab under the supervision of Dr Marco Cook.